Dynamic Client Registration

For ecosystems where clients register themselves (RFC 7591) rather than being provisioned by an admin. Gated by a per-instance flag — when off, registration is 403.

POST   /oauth2/register            → register a client (RFC 7591). Validates https/localhost redirect_uris.
                                      Returns the new client_id and, for confidential clients, a secret.
GET    /oauth2/register/:clientId  → read config (RFC 7592)
PUT    /oauth2/register/:clientId  → update config (RFC 7592)
DELETE /oauth2/register/:clientId  → delete (RFC 7592)

The management endpoints (RFC 7592) authenticate with the registration_access_token issued at registration — not your instance keys.

curl https://accounts.yourapp.com/oauth2/register \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "Partner App",
    "redirect_uris": ["https://partner.example.com/callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "token_endpoint_auth_method": "client_secret_basic"
  }'

The response includes client_id, (for confidential clients) client_secret, and a registration_access_token + registration_client_uri for later management.

Admin-provisioned clients

If you provision clients yourself instead, use the BAPI OAuth clients endpoints (POST /v1/oauth_clients), which give you scoping, secret rotation, and resource-server grants.